CVE-2026-90278

In the Linux kernel, the following vulnerability has been resolved: md: wait for behind writes before destroying bitmap __md_stop() destroyed the bitmap before calling mddev_detach(). That made mddev_detach() skip bitmap_ops->wait_behind_writes(), because the bitmap was already disconnected from mddev. This was still safe for the legacy bitmap because bitmap_destroy() waits for behind writes itself. llbitmap keeps that wait in its ->wait_behind_writes() operation instead, while ->destroy() tears down the llbitmap storage. With the old ordering, RAID1 behind-write completions could still run after llbitmap storage had been freed. Call mddev_detach() before md_bitmap_destroy() so the common detach path can wait for behind writes while the bitmap is still alive. Only destroy the bitmap after those users are gone.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/2a79365b2278f16e163e4024086105693b421601
https://git.kernel.org/stable/c/4224dccd325a9380e8edfb66aad8bb5771c94222
https://git.kernel.org/stable/c/73881ff7a75913f919a1ce9d9571bfaab8e8588d

Configurations

No configuration.

History

17 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 17:17

Updated : 2026-09-17 17:17

NVD link : CVE-2026-90278

Mitre link : CVE-2026-90278

CVE.ORG link : CVE-2026-90278

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-90278", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5ab829f1971dc99f2aac10846c378e67fc875abc", "lessThan": "73881ff7a75913f919a1ce9d9571bfaab8e8588d", "versionType": "git"}, {"status": "affected", "version": "5ab829f1971dc99f2aac10846c378e67fc875abc", "lessThan": "4224dccd325a9380e8edfb66aad8bb5771c94222", "versionType": "git"}, {"status": "affected", "version": "5ab829f1971dc99f2aac10846c378e67fc875abc", "lessThan": "2a79365b2278f16e163e4024086105693b421601", "versionType": "git"}], "programFiles": ["drivers/md/md.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"status": "unaffected", "version": "0", "lessThan": "6.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.52", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.6", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/md/md.c"], "defaultStatus": "affected"}]}], "published": "2026-09-17T17:17:24.460", "references": [{"url": "https://git.kernel.org/stable/c/2a79365b2278f16e163e4024086105693b421601", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4224dccd325a9380e8edfb66aad8bb5771c94222", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/73881ff7a75913f919a1ce9d9571bfaab8e8588d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: wait for behind writes before destroying bitmap\n\n__md_stop() destroyed the bitmap before calling mddev_detach(). That made\nmddev_detach() skip bitmap_ops->wait_behind_writes(), because the bitmap\nwas already disconnected from mddev.\n\nThis was still safe for the legacy bitmap because bitmap_destroy() waits\nfor behind writes itself. llbitmap keeps that wait in its\n->wait_behind_writes() operation instead, while ->destroy() tears down the\nllbitmap storage. With the old ordering, RAID1 behind-write completions\ncould still run after llbitmap storage had been freed.\n\nCall mddev_detach() before md_bitmap_destroy() so the common detach path\ncan wait for behind writes while the bitmap is still alive. Only destroy\nthe bitmap after those users are gone."}], "lastModified": "2026-09-17T17:17:24.460", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}